Certify Clouds

CertifyClouds automates the Azure secret lifecycle. It discovers secrets, keys, and certificates across all your Key Vaults and App Registrations, flags what is expiring, automates credential rotation with zero-downtime overlap windows, and syncs secrets and certificates to AWS and GCP for disaster recovery.

It runs as a self-hosted Docker container in YOUR Azure subscription. Your secrets never leave your environment. The only external call is license validation.

WHAT IT DOES

- Discovery: Scans every Key Vault across all connected Azure subscriptions. Surfaces secrets, certificates, and keys with expiry dates, version history, and the applications that consume them. Also scans App Registration credentials in Entra ID.

- Compliance Dashboard: Scores your secret estate on expiry policy, rotation frequency, key size, and algorithm standards. Custom rules and auditor-ready evidence exports.

- Alerts: Email and webhook notifications (including PagerDuty) at 30, 14, and 7 days before expiry. Daily or weekly digests.

- Rotation (Pro): Automated rotation of App Registration client secrets and certificates. Creates the new credential, stores it in Key Vault, propagates to App Services, Functions, and Container Apps, verifies the rollover, then disables the old credential.

- Multi-Cloud Sync (Pro): Replicates selected secrets and certificates to AWS Secrets Manager, Parameter Store, and Certificate Manager, and to GCP Secret Manager and Certificate Manager. Re-synced on every rotation.

- Asset Dependencies (Pro): Maps which Azure resources consume each secret, so you see the blast radius before you rotate.

- External Tenants (Pro): Registers and scans Azure AD B2C and Entra External ID tenants alongside your workforce tenant.

- Multi-Tenant Management and MCP Connector (Enterprise): Manage several Azure tenants from one console, and give Claude or ChatGPT read-only access to your credential inventory through a customer-authorised MCP connector.

- Audit Log: Every action is recorded with actor, timestamp, and outcome. Hash-chained CSV export and PDF evidence bundle.

DEPLOYMENT

Deploy to Azure Container Apps or Azure Container Instances in about 10 minutes. Uses Azure RBAC with minimal permissions. Discovery reads metadata only, never secret values.

PRICING

- Starter, GBP 49 per month: Discovery, compliance, alerts, audit log, 3 rotations per month, up to 4 subscriptions, single user. 30-day free trial.

- Pro, GBP 399 per month: Everything in Starter plus unlimited automated rotation, multi-cloud sync, asset dependencies, SSO (OIDC and Entra ID), external tenant scanning, custom compliance rules, unlimited users, up to 20 subscriptions. 30-day free trial.

- Enterprise: Custom pricing for 21+ subscriptions, multi-tenant management, MCP Connector, priority support, and custom contracts.

REQUIREMENTS

An Azure subscription with Key Vaults, a Container Apps or Container Instances target, a PostgreSQL database, and Key Vault Reader (plus rotation roles where used).

SUPPORT

Documentation: https://docs.certifyclouds.com | Email: support@certifyclouds.com | Website: https://certifyclouds.com/support